SymbOS.Hati Hati.A SMS Virus

SymbOS.Hatihati.A is a Trojan horse that runs on the Symbian OS. The Trojan is a pirated version of the anti-theft software Guardian v0.95 which contains a bad configuration file. This virus resides at Mobile Memory and tries to send SMS automatically to the predefined numbers like +3396003964. HatiHati.A is a worm-like application that spreads via MMC cards. Once the worm copies itself to a new device, it starts sending a very high volume of SMS messages to a predefined number. The predefined number is inherent with the Hatihati.A malware and will not be picked from the contact list.

Below mentioned are the destination numbers detected so far that affected mobile is trying to send SMS automatically (due to virus infection).

• 3355713230
• 3203848325
• 3474935252
• 3207012810
• 3932590983
• 3396003964

* MMS sending is not affected by this virus because MMS is sent via GPRS.

* There is no known application that can detect this virus in any brand of mobile set.

Name :	Worm:SymbOS/HatiHati.A
Alias:	HatiHati.A
Type:	Worm
Category:	Malware
Platform:	SymbOS

Common symptoms of Hatihati.A malware infection:

* A Hatihati.A malware icon in the applications folder of the phone when the phone is rebooted without the SIM card.
* Unrecognized texted numbers on your cellphone logs.
* Difficulty in sending SMS due to the continuous sending of the said malware.
* Abnormally fast depletion of battery charge/power.

Removal processes of the Hatihati.A Malware:

These are the recommended ways to remove the Hatihati.A malware:

1. Download F-secure software antivirus for Nokia and Non Nokia handsets and delete the "Guardian" Folder.
2. Soft or hard formatting.
i. Create backup the address book, calendar and settings using "Nokia PC Suite"
ii. Format the MMC card from the computer using card reader
3. Use Deep Reset using code (*#7370# or *#7780")
Normal Reset (*#7780#) : Restores ini files from rom but preserves user data (photos, 3rd party apps etc)
Deep Reset (*#7370#) : This reformats completely the C: drive. All applications and files stored in this drive will be lost and clean default files will be rewritten.
4. Use 12345 as lock code ( for Nokia handsets ) when asked and press OK
5. Now Mobile will be restarted and will beback to its previous settings
* For detailed information regarding soft and hard formatting, please refer to the last section ( Step by step information on how to remove Hati Hati virus).

For more Information: